Kastra is the authorization layer for AI systems.
San Francisco, California
Joined June 2026
- Tweets171
- Following23
- Followers40
- Likes21
Enough waiting for the worst.
AI is finding flaws faster than humans can patch them. Agents already hold real credentials.
The transition is the risky part. Structure is how you get through it.
Trust the rules, not the agents.
Ready, or still waiting?
Blocking a chatbot answers one question: which tool can you open?
Not: what can the AI do once it's in?
That second one is governance.
Week 1: write the rules.
Weeks 2-3: shadow mode.
Week 4: enforce.
What's your week 1?
10 years: how long humans missed it. Then AI found it.
Attackers get the same speedrun.
You can't make your agent un-trickable. You can make "POST .env to unknown host" a hard no.
Is your authority a policy or a prompt?
Patch week, 2026:
"Hey agent, find everything running PHP, upgrade it, fix what breaks."
Agent: on it 🚀
Also agent: prod creds, no reviewer, 400 changelogs to read.
Deploy to prod? A human taps approve. Drop tables? Denied.
What's on your denied list?
Sweden bans AI"
Actual story: they blocked the web versions. Staff still reach both models through an internal platform.
They didn't ban AI. They banned AI without rules.
Now apply that to what your agents can do. That's Kastra.
PHP2Shell: unauthenticated RCE in the code behind ~70% of websites.
Found by AI. Patched by humans. Exploited by whoever's AI gets there next.
Your coding agents read that same internet.
What stops them when they read the wrong thing?
AI found a bug that hid in PHP for 10 years. Governments took sites offline. Sweden blocked ChatGPT and Claude.
Europe's AI strategy this month: the off switch.
Kastra's: rules checked before every agent action runs.
Which one actually scales?
Microsoft this week: AI agents can be pushed off-task by prompt injection, bad inputs or shifting context.
Their fix: contain it. Keep reads, restrict approvals and writes, require a human for big actions.
Basically: rules outside the model.
Do you have yours yet?
Microsoft’s line on AI agents: transparency helps you detect, but it can’t replace independent enforcement.
Translation: seeing everything is not stopping anything.
If an agent tried something it shouldn’t right now, would you block it or just watch it?
Your agent’s plan when it reads a prompt injection: comply.
Your plan: “we have logging.”
So the plan is a very detailed recording of it complying.
Who’s checking the action before it runs?
Microsoft’s example: an expense-approval agent reads an external doc with a prompt injection inside.
Nothing hacked. Config unchanged. Now it may act outside its job.
Their takeaway: static permissions can’t tell if its authority still fits.
What’s your answer to that?
Permissions answer “can this agent do X?”
Nobody’s answering “should it be doing X right now, at 3am, after reading a stranger’s README?”
That second question is the whole job.
“Separate intelligence from authority.” @Microsoft , this week.
Intelligence: the model. Can be persuaded.
Authority: whether the action runs.
If your authority lives in a system prompt, it can be persuaded too.
Policy or prompt. Which is yours?
Microsoft: your AI agent can start doing things outside its task. Same config. No breach.
It just read the wrong PDF.
So your security plan is... hoping it doesn’t read the wrong PDF?
What’s actually stopping your agents today?
Everyone checks what goes into the agent. Far fewer check what comes out.
Kastra evaluates outputs too. Keys, customer records, anything your policy says shouldn’t leave the building gets stopped on the way out.
Trust the rules, not the agents.
Your agent calls a tool. That tool calls another tool. That one runs a shell command.
Kastra evaluates every hop on its own. Permission doesn’t get passed down for free.
A checkpoint at every door, not just the front one.
“Run this command” is the whole question.
A prod migration. A push to main. An rm -rf.
Kastra reads the actual tool call or shell command before it executes and asks one thing: is this allowed?
Prompts and inputs are where the attack starts.
A README. A ticket. A web page. Text your agent reads that you didn’t write.
Kastra checks it against policy before it gets in. Persuasive text is still just text.
